Sync Sanctum, Socialite, Horizon and Reverb updates and port Sentinel

.php-cs-fixer.php

@@ -110,7 +110,7 @@
         PhpCsFixer\Finder::create()
             ->exclude('_archive')
             ->exclude('_tmp')
-            ->exclude('dogfood/testbench-package/vendor')
+            ->exclude('node_modules')
             ->exclude('overrides')
             ->exclude('src/testbench/workbench/bootstrap/cache')
             ->exclude('src/testbench/workbench/runtime')

composer.json

@@ -202,6 +202,7 @@
         "hypervel/saloon": "self.version",
         "hypervel/sanctum": "self.version",
         "hypervel/scout": "self.version",
+        "hypervel/sentinel": "self.version",
         "hypervel/sentry": "self.version",
         "hypervel/server": "self.version",
         "hypervel/server-process": "self.version",
@@ -282,6 +283,7 @@
             "Hypervel\\Saloon\\": "src/saloon/src/",
             "Hypervel\\Sanctum\\": "src/sanctum/src/",
             "Hypervel\\Scout\\": "src/scout/src/",
+            "Hypervel\\Sentinel\\": "src/sentinel/src/",
             "Hypervel\\Sentry\\": "src/sentry/src/",
             "Hypervel\\ServerProcess\\": "src/server-process/src/",
             "Hypervel\\Server\\": "src/server/src/",
@@ -357,7 +359,8 @@
             "aliases": {
                 "OpenTelemetry": "Hypervel\\OpenTelemetry\\Facades\\OpenTelemetry",
                 "Saloon": "Hypervel\\Saloon\\Facades\\Saloon",
-                "Sentry": "Hypervel\\Sentry\\Facade"
+                "Sentry": "Hypervel\\Sentry\\Facade",
+                "Socialite": "Hypervel\\Socialite\\Socialite"
             },
             "providers": [
                 "Hypervel\\Auth\\AuthServiceProvider",

docs/todo.md

@@ -70,7 +70,3 @@
 ## Notifications
 
 - Design a provider-agnostic first-party SMS notification API before adding an SMS provider. Keep Horizon's existing `Horizon::routeSmsNotificationsTo(...)`, but have Horizon target the generic channel and message contract rather than a vendor class; provider packages should adapt that contract to Vonage or other services. Decide routing, provider selection, message construction, per-message client overrides, and failure reporting, then implement the first adapter and update the notification and Horizon documentation, stubs, and Boost references. Keep mutable third-party SDK clients isolated per send—Vonage's client caches resources that mutate request and response state around yielding HTTP calls—while reusing only immutable configuration and the coroutine-safe transport. Add standalone package, provider, direct-construction, routing, failure, Horizon mail/Slack/SMS, and deterministic concurrent-send coverage. Do not add obsolete Nexmo names or compatibility aliases.
-
-## Sentinel
-
-- Port `laravel/sentinel` as `hypervel/sentinel`, add direct Horizon and Telescope dependencies, and prepend `SentinelMiddleware:horizon` and `SentinelMiddleware:telescope` while preserving configured middleware. Remove Horizon's temporary `REMOVED:` source comment and cover both dashboards' security integration.

docs/upstream-sync/sync.yaml

@@ -67,21 +67,30 @@ laravel/passkeys-server:
 
 laravel/sanctum:
   branch: 4.x
-  checked_through: null
-  last_reviewed_pr: null
-  sync_date: null
+  checked_through: 1aa53e0b955415571837971ee6ca0a9427c58a4f
+  last_reviewed_pr: 620
+  sync_date: '2026-10-02'
 
 laravel/socialite:
   branch: 5.x
-  checked_through: null
-  last_reviewed_pr: null
-  sync_date: null
+  checked_through: fa0181ee6204ca28a55cd67145fadd631ac209cf
+  last_reviewed_pr: 793
+  sync_date: '2026-10-02'
+  notes: Google, Facebook and generic OpenID Connect ID-token verification share Two\Concerns\InteractsWithJwks, so upstream key-loading changes (phpseclib, getPublicKeyOfOIDCToken) map there, and upstream tests that stub key loading use the RSA fixtures in tests/Socialite/Fixtures/CreatesJwksFixtures.php.
+
+laravel/sentinel:
+  branch: 1.x
+  checked_through: b8e15909d59bbcff3d63e74a7858c9350027b485
+  last_reviewed_pr: 17
+  sync_date: '2026-10-02'
+  notes: SentinelServiceProvider is not ported because its only job is a scoped SentinelManager binding. Hypervel auto-singletons the unbound manager, so drivers registered with extend() during boot reach every coroutine; a coroutine-scoped manager would lose them.
 
 laravel/horizon:
   branch: 5.x
-  checked_through: null
-  last_reviewed_pr: null
-  sync_date: null
+  checked_through: 5d9f80448a192d03ddb338cf91f73fbe5a50e250
+  last_reviewed_pr: 1823
+  sync_date: '2026-10-02'
+  notes: horizon:listen maps to Hypervel\Watcher and Console\HorizonRestartStrategy; assess behavior changes in upstream's bin/file-watcher.cjs against them instead of copying the Node script. Metric clearing uses the Redis flushByPattern/SafeScan operations instead of an inline SCAN loop. Rebuild dist with npm 11.10 or newer after resource or frontend dependency changes.
 
 laravel/reverb:
   branch: main

src/docs/horizon.md

@@ -174,8 +174,6 @@ If the `defaults` option is omitted, Horizon applies no shared supervisor option
 
 The Horizon dashboard may be accessed via the `/horizon` route. By default, you will only be able to access this dashboard in the `local` environment. However, within your `app/Providers/HorizonServiceProvider.php` file, there is an [authorization gate](/docs/{{version}}/authorization#gates) definition. This authorization gate controls access to Horizon in **non-local** environments. You are free to modify this gate as needed to restrict access to your Horizon installation:
 
-The required `path` option controls the routes registered by the application. The required `proxy_path` option only prefixes URLs generated by the dashboard when a reverse proxy strips an external subdirectory before forwarding requests. Set `proxy_path` to an empty string when no external prefix is needed.
-
 ```php
 /**
  * Register the Horizon gate.
@@ -192,6 +190,10 @@ protected function gate(): void
 }
 ```
 
+Since the dashboard doesn't require a login in the `local` environment, Horizon rejects local dashboard requests that a [trusted proxy](/docs/{{version}}/requests#configuring-trusted-proxies) forwards on behalf of a public IP address, such as visitors arriving through an ngrok or Expose tunnel. Until you configure trusted proxies, requests to ngrok and Expose hostnames fail with an error, since Horizon can't see the visitor's address. To share the dashboard through a tunnel, run the application in a non-local environment so the gate protects it.
+
+The required `path` option controls the routes registered by the application. The required `proxy_path` option only prefixes URLs generated by the dashboard when a reverse proxy strips an external subdirectory before forwarding requests. Set `proxy_path` to an empty string when no external prefix is needed.
+
 <a name="alternative-authentication-strategies"></a>
 #### Alternative Authentication Strategies
 
@@ -289,6 +291,7 @@ In addition to `tries`, `timeout`, and `backoff`, each supervisor accepts severa
             'sleep' => 3,
             'rest' => 0,
             'nice' => 0,
+            'json' => false,
         ],
     ],
 ],
@@ -302,6 +305,7 @@ In addition to `tries`, `timeout`, and `backoff`, each supervisor accepts severa
 - `sleep` defines the number of seconds a worker should wait when no job is available before polling the queue for new jobs again. By default, this value is `3`.
 - `rest` defines the number of seconds to pause between processing each job. By default, this value is `0`.
 - `nice` defines the "niceness" (scheduling priority) of the worker processes. A higher value gives the process a lower priority. By default, this value is `0`.
+- `json` determines if worker processes output their job updates and stop information as JSON, like the `queue:work` command's [`--json` option](/docs/{{version}}/queues#the-queue-work-command). By default, this value is `false`.
 
 </div>
 
@@ -398,12 +402,13 @@ For example, you may configure Horizon to maintain at least one process per queu
 ],
 ```
 
-The `autoScalingStrategy` configuration option determines how Horizon will assign more worker processes to queues. You can choose between two strategies:
+The `autoScalingStrategy` configuration option determines how Horizon will assign more worker processes to queues. You can choose between three strategies:
 
 <div class="content-list" markdown="1">
 
 - The `time` strategy will assign workers based on the total estimated amount of time it will take to clear the queue.
 - The `size` strategy will assign workers based on the total number of jobs on the queue.
+- The `log` strategy will assign workers based on the logarithm of the number of jobs on the queue. This prevents a significantly larger queue from receiving a disproportionately large share of workers.
 
 </div>
 

src/docs/porting-from-laravel.md

@@ -31,6 +31,7 @@
     - [CSRF Protection](#csrf-protection)
     - [Fortify](#fortify)
     - [Scout](#scout)
+    - [Socialite](#socialite)
     - [JSON Schema](#json-schema)
     - [Validation](#validation)
     - [Request and Input Data](#request-and-input-data)
@@ -540,6 +541,13 @@ Fortify ignores Laravel's `fortify.passwords` setting. Declare the password rese
 
 Hypervel compiles integer and float values passed to Scout's Algolia `where`, `whereIn`, and `whereNotIn` methods as numeric comparisons. Numeric-looking strings remain facet values. When porting an Algolia index, ensure the indexed attribute type matches the PHP value type used by these filters.
 
+<a name="socialite"></a>
+### Socialite
+
+Custom Socialite providers should read request-specific state through getters such as `getRequest()`, `getParameters()`, `getScopes()`, and `getClientId()`. Properties such as `$parameters`, `$scopes`, and `$clientId` only hold the defaults shared by every request, so reading them directly ignores `with()`, `scopes()`, and `setConfig()` calls. Build custom OAuth 2.0 drivers with `buildOAuth2Provider()` instead of `buildProvider()`. See [custom providers](/docs/{{version}}/socialite#custom-providers).
+
+Google users' raw data does not include Laravel's deprecated `id`, `verified_email`, and `link` keys. Read `sub`, `email_verified`, and `profile` instead.
+
 <a name="json-schema"></a>
 ### JSON Schema
 

src/docs/reverb.md

@@ -146,10 +146,10 @@ return [
                 'max_message_size' => (int) env('REVERB_APP_MAX_MESSAGE_SIZE', 10_000),
                 'accept_client_events_from' => env('REVERB_APP_ACCEPT_CLIENT_EVENTS_FROM', 'members'),
                 'rate_limiting' => [
-                    'enabled' => (bool) env('REVERB_APP_RATE_LIMIT_ENABLED', false),
+                    'enabled' => (bool) env('REVERB_APP_RATE_LIMITING_ENABLED', false),
                     'max_attempts' => (int) env('REVERB_APP_RATE_LIMIT_MAX_ATTEMPTS', 60),
                     'decay_seconds' => (int) env('REVERB_APP_RATE_LIMIT_DECAY_SECONDS', 60),
-                    'terminate_on_limit' => (bool) env('REVERB_APP_RATE_LIMIT_TERMINATE_ON_LIMIT', false),
+                    'terminate_on_limit' => (bool) env('REVERB_APP_RATE_LIMIT_TERMINATE', false),
                 ],
             ],
         ],

src/docs/socialite.md

@@ -468,7 +468,11 @@ use Hypervel\Socialite\Socialite;
 $user = Socialite::driver('github')->userFromToken($token);
 ```
 
-If you are using Facebook Limited Login via an iOS application, Facebook will return an OIDC token instead of an access token. Like an access token, the OIDC token can be provided to the `userFromToken` method in order to retrieve user details.
+If you are using Facebook Limited Login via an iOS application, Facebook will return an OIDC token instead of an access token. To retrieve user details from the OIDC token, provide the nonce used to initiate the login to the `userFromToken` method:
+
+```php
+$user = Socialite::driver('facebook')->userFromToken($token, $nonce);
+```
 
 Google ID tokens may also be provided to the `google` driver's `userFromToken` method. Hypervel will verify the JWT token before returning the user details:
 

src/docs/telescope.md

@@ -161,6 +161,8 @@ protected function gate(): void
 }
 ```
 
+Since the dashboard doesn't require a login in the `local` environment, Telescope rejects local dashboard requests that a [trusted proxy](/docs/{{version}}/requests#configuring-trusted-proxies) forwards on behalf of a public IP address, such as visitors arriving through an ngrok or Expose tunnel. Until you configure trusted proxies, requests to ngrok and Expose hostnames fail with an error, since Telescope can't see the visitor's address. To share the dashboard through a tunnel, run the application in a non-local environment so the gate protects it.
+
 > [!WARNING]
 > You should ensure you change your `APP_ENV` environment variable to `production` in your production environment. Otherwise, your Telescope installation will be publicly available.
 

src/horizon/.gitignore

@@ -1,7 +1 @@
-/vendor
-/laravel
 /node_modules
-/phpunit.xml
-composer.lock
-.phpunit.result.cache
-.phpunit.cache/

src/horizon/.npmrc

@@ -3,3 +3,4 @@
 # dramatically reduces the chance of pulling a malicious release.
 # npm measures this value in days.
 min-release-age=7
+ignore-scripts=true

src/horizon/README.md

@@ -8,5 +8,8 @@ Documentation: https://hypervel.org/docs/horizon
 ## Differences From Laravel
 
 - The deprecated `horizon:publish` command is not included. Use `horizon:install` instead.
+- `horizon:listen` uses Hypervel's file watcher instead of a Node.js `chokidar` process, so Node is not required. A nonempty `horizon.watch` list replaces the `watcher` configuration's watch list, and `--poll` selects its scanning driver. See [automatically restarting Horizon](https://hypervel.org/docs/horizon#automatically-restarting-horizon).
+- Supervisors accept a `concurrency` option that lets each worker process run several jobs at once in coroutines. See [concurrency](https://hypervel.org/docs/horizon#concurrency).
+- Redis Cluster is configured on the named Redis connection selected by `horizon.use`. Laravel's top-level `database.redis.clusters` entries are not read.
 
 Ported from: https://github.com/laravel/horizon

src/horizon/composer.json

@@ -46,6 +46,7 @@
         "hypervel/queue": "^0.4",
         "hypervel/redis": "^0.4",
         "hypervel/routing": "^0.4",
+        "hypervel/sentinel": "^0.4",
         "hypervel/support": "^0.4",
         "hypervel/watcher": "^0.4",
         "symfony/console": "^8.1.2",